b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 17:59

Target

b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe
Size

1.5MB
MD5

dc5264931d0ca12018e03a1dc7113c88
SHA1

3d1c9df0b31ea0410cb9d7f419af3e5bba48e1a6
SHA256

b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8
SHA512

8f5eedf95d0de0ddb4f81bf92a9370f5ec948a988f769d59227ef455e6a95421cdfc79cf58adaaefa401ea8e344525f7b7c72b7febc6250946120b7cbf8a6aa7
SSDEEP

24576:C5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+c:oIBfvMkrNrf0u3qdaNLgQWiO+8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3140 set thread context of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79
PID 3140 wrote to memory of 2688	3140	b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe	79

C:\Users\Admin\AppData\Local\Temp\b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe
"C:\Users\Admin\AppData\Local\Temp\b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\b6e0a185b14412800dd002fc55702ba6252b6958e9d45d6080ba224b872ef4a8.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2688

memory/2688-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2688-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2688-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2688-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2688-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download